moonpay-commerce-mbr3iglgp-heliofi.vercel.app
Category: Phishing
To use full-featured product, you have to purchase a license for Combo Cleaner. Limited seven days free trial available. Combo Cleaner is owned and operated by RCS LT, the parent company of PCRisk.com.
Description of moonpay-commerce-mbr3iglgp-heliofi.vercel.app
This domain presents itself as a MoonPay Commerce login or onboarding page related to cryptocurrency payments. The page title and metadata describe a service for accepting crypto payments, and the screenshot shows branding for “MoonPay Commerce,” an email entry field, and a wallet sign-in option. It also references commerce.moonpay.com and assets hosted under hel.io, suggesting the page is attempting to resemble a financial or crypto-commerce service.
However, the actual hostname is a long subdomain under vercel.app rather than an official MoonPay-owned primary domain. Based on the domain structure, branding, and page content, this appears to be a hosted landing page that may be imitating a legitimate crypto payment platform rather than a standard corporate website. The site falls most closely into a phishing-oriented financial-services context.
Safety Assessment for moonpay-commerce-mbr3iglgp-heliofi.vercel.app
Scan results indicate elevated risk at the time of this scan. The domain was flagged by 16 out of 91 security engines, and multiple web-classification providers categorized it as phishing or fraud-related content. Although one malware scan reported no malicious files and no flagged external links, that result does not outweigh the broader phishing consensus from the reputation data.
The page also uses branding associated with a known crypto payments company while operating from a vercel.app subdomain instead of the brand’s main web domain. That kind of domain mismatch may be consistent with a look-alike or impersonation setup, especially for a page requesting email or wallet-based sign-in. In addition, the domain’s IP address is listed on one mail-reputation blocklist, which is a weaker signal than phishing detections but still adds minor caution.
Based on these findings, this website may pose potential risks to visitors.
Technical Description
The site uses a valid SSL/TLS certificate issued by a mainstream certificate authority, with expiry shown as 2026-09-26. It is hosted on Vercel infrastructure and uses Vercel nameservers, indicating deployment through a cloud hosting platform commonly used for fast static or app-based sites. DNSSEC appears to be unsigned.
From a technical perspective, the page looks like a modern JavaScript application with Next.js-style static assets. No malicious files were detected in the file-level scan, but the main concern here appears to be potential phishing or brand impersonation rather than malware delivery. The use of a hosted subdomain instead of an official brand domain is a notable trust concern for a financial login-style page.
Share your experience with this website. Was it safe? Did you encounter any issues?